Embodiments in accordance with the present disclosure relate to computer networks, and particularly to security in computer networks.
Network resources such as those available via the Internet are accessed according to Internet Protocol (IP) addresses. IP addresses are represented numerically, traditionally as a quartet of values having the form 111.111.111.111. From the early inception of network computing, familiar alphanumeric name-based addressing has been used to allow users to more easily locate and remember the addresses for resources. For example, domain names are assigned to computing servers and clients. The domain name system facilitates the translation between IP addresses and domain names by maintaining accessible records that associate one or more domain names with one or more IP addresses.
Malware such as computer viruses, Trojan horses, worms, botnets and the like is often distributed over the Internet as or with network resources. Numerous anti-malware products exist that detect, block and/or remove malware from devices. Over time, particular domain names may become associated with the distribution of malware. So-called block lists have been developed that list domains associated with malware. Domains may be identified for placement on a block list in numerous ways. For example, researchers can retrieve network resources and analyze the content of the resource for the presence of malware. Similarly, software can analyze the content of network resources to detect the presence of malware. Once identified, these domain names can be added to a block list and published for use by network devices. A client device or network router may block the transfer of content from a domain on a block list for example.